An external procedure is database-executed code that runs outside the core database engine. Instead of using only built-in SQL or stored logic, the database calls a routine in another language or a linked library, sometimes reaching operating-system functions or local files. This can be useful for performance or specialized features, but it also widens the attack surface because the database is no longer confined to its own internal runtime.
In cyber security, external procedures matter because they can turn a database bug into system-level impact. If an attacker can abuse SQL injection, unsafe grants, or over-privileged stored code, they may be able to trigger an external procedure and make the database service execute code on the host. Defenders reduce this risk by disabling unused external execution, limiting who can create or run it, auditing invocations, and monitoring for unexpected process or file activity. Least privilege and parameterized queries help prevent attackers from ever reaching this boundary.